Account: your email address, and your name and profile picture if you sign in with Google or GitHub. We also remember which sign-in method you used last. Sign-in links and one-time codes are sent by email; links expire after 5 minutes and codes after 10 minutes. We don't use passwords.
Billing: Stripe processes your payment. We receive and keep your plan, subscription status, renewal dates, invoice amounts, currency and Stripe's order and customer IDs, and with each order the pricing details of that checkout (pricing country, currency, the price list used and, if a price test was running, the test and group you were in). We never receive or store your full card number. For introductory-price checkouts we keep the card fingerprint Stripe provides (a code that identifies the card without revealing its number), so each card gets the introductory price only once.
Pricing country and price tests: our prices depend on your country (see the Subscription Terms). On your first visit we work out your country from your IP address (no precise location) and keep it in a first-party cookie, so the prices you see don't change when you travel or use a VPN. When you first go to checkout, that country is stored on your account (pricing country) and used for your later checkouts, because a subscription keeps its currency. If we run a price test in your country, a random device ID and the group you were assigned to are kept in first-party cookies so you keep seeing the same prices, and the group is attached to your checkout. If you accept optional cookies, we also report to Google Analytics that you saw a price test (the test and group, no personal details). The cookies are listed in the Cookie Policy.
Usage: credits granted and used, which tools you ran and when, your free daily run count and, on a plan, fair use counters (how many runs, words, searches or messages you used per tool group in each UTC day, kept for the rolling 30-day fair use window). The free count is tied to a random device ID kept in your browser and to your IP address, and when you are signed in also to your account.
Technical: IP address and browser details, used to rate-limit requests, prevent abuse and keep accounts secure. Our server and error logs record technical events such as failed requests; they may include your account email or IP address when something goes wrong with your account, but not the text or files you put into a tool.
Marketing attribution: if you arrive from an ad or a tagged link, the ad click ID (gclid), UTM tags, landing page and referring site are saved in a first-party cookie, only after you click Accept on the cookie banner, and attached to your checkout, so we can tell which campaigns lead to subscriptions. Until you choose, this is held only in your browser tab; it is not collected if you decline optional cookies.
Sign-up source (only when sign-up source tracking is on, and only after you accept optional cookies): when you create an account we save the campaign or referral link you came from, your landing page and referring site, your IP address and approximate country, and browser details (browser, operating system, device type and model, screen size, language and time zone).
Messages: what you send through the contact form, the live chat or the feedback form (which needs you to be signed in), plus the email address and name you give us or that your account holds.